General

  • Target

    ragnar_locker_EDP (4)

  • Size

    116KB

  • Sample

    200803-jsqk6fb3q6

  • MD5

    63241a7a39692f90328a72c0e9826afd

  • SHA1

    016ef5b9e91eb9a90af39dbb2c66fe527de12f92

  • SHA256

    30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c

  • SHA512

    6a758b525c665c45770b18d84f2cb8a38b45d8093558bf15f5e7f53283c0352bd9afd54cfdac21e3deaf146fb840ba5ba32b9da765902f36ef7aa126cc8287c1

Malware Config

Extracted

Path

C:\Users\Public\Documents\RGNR_AC7AABB2.txt

Family

ragnarlocker

Ransom Note
***************************************************************************************************************** HELLO EDP.com ! If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** !!!!! WARNING !!!!! DO NOT Modify, rename, copy or move any files or you can DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it also may damage files. DO NOT Shutdown or reset your system ------------------------------------- There is ONLY ONE possible way to get back your files - contact us and pay for our special decryption key ! For your GUARANTEE we will decrypt 2 of your files FOR FREE, as a proof of our capabilities Don't waste your TIME, the link for contacting us will be deleted if there is no contact made in closest future and you will never restore your DATA. HOWEVER if you will contact us within 2 day since get penetrated - you can get a very SPECIAL PRICE. ATTENTION ! We had downloaded more than 10TB of data from your fileservers and if you don't contact us for payment, we will publish it or sell to interested parties. Here is just a small part of your files that we have, for a proof (use Tor Browser for open the link) : http://p6o7m73ujalhgkiv.onion/?p=171 We gathered the most sensitive and confidential information about your transactions, billing, contracts, clients and partners. And be assure that if you wouldn't pay, all files and documents would be publicated for everyones view and also we would notify all your clients and partners about this leakage with direct links. So if you want to avoid such a harm for your reputation, better pay the amount that we asking for. ============================================================================================================== ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTACT WITH US VIA LIVE CHAT ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! a) Download and install TOR browser from this site : https://torproject.org b) For contact us via LIVE CHAT open our website : http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E c) For visit our NEWS PORTAL with your data, open this website : http://p6o7m73ujalhgkiv.onion/?page_id=171 d) If Tor is restricted in your area, use VPN When you open LIVE CHAT website follow rules : Follow the instructions on the website. At the top you will find CHAT tab. Send your message there and wait for response (we are not online 24/7, So you have to wait for your turn). *********************************************************************************** ---RAGNAR SECRET--- NmJFQ0EyYjJBRkZmQkMxRGZmMGFhMEVhYUFkNDY4YmVjMDkwM2I1ZTRFYTU4ZWNkZTNDMjY0YkM1NWM3Mzg5RQ== ---RAGNAR SECRET--- ***********************************************************************************
URLs

http://p6o7m73ujalhgkiv.onion/?p=171

http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E

http://p6o7m73ujalhgkiv.onion/?page_id=171

Targets

    • Target

      ragnar_locker_EDP (4)

    • Size

      116KB

    • MD5

      63241a7a39692f90328a72c0e9826afd

    • SHA1

      016ef5b9e91eb9a90af39dbb2c66fe527de12f92

    • SHA256

      30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c

    • SHA512

      6a758b525c665c45770b18d84f2cb8a38b45d8093558bf15f5e7f53283c0352bd9afd54cfdac21e3deaf146fb840ba5ba32b9da765902f36ef7aa126cc8287c1

    • RagnarLocker

      Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Impact

Inhibit System Recovery

2
T1490

Tasks